CVE Intelligence
Analysis AI-assisted

CVE-2026-52986: Linux kernel netfilter SIP conntrack port parsing NULL pointer dereference

A Linux kernel change in the netfilter SIP connection tracking helper (nf_conntrack_sip) replaces unsafe port parsing that relied on simple_strtoul() and dereferenced pointers without adequate bounds checks. The CNA classifies the issue as CWE-476 (NULL Pointer Dereference) with a CVSS 3.1 score of 9.8 (critical). The record shows no CISA KEV listing and no confirmed exploitation in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

This record describes a change to the Linux kernel netfilter connection tracking helper for SIP (nf_conntrack_sip). The previous code parsed port numbers with simple_strtoul() on buffers that were not NUL-terminated and dereferenced pointers without adequate bounds checks. The upstream change adds a sip_parse_port() helper that validates each digit against the buffer limit.

Impact

  • The CNA classifies the weakness as CWE-476, NULL Pointer Dereference.
  • The record provides a CVSS 3.1 score of 9.8 (critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
  • Under the standard CVSS definitions, that vector describes a network-reachable issue requiring no privileges or user interaction, with high impact on confidentiality, integrity and availability. This is an inference from the vector.
  • The record does not describe a specific crash, data exposure or code execution outcome. Those effects remain unknown from the available data.

Affected products and versions

The record lists the Linux Kernel with the following ranges:

  • from 2.6.26 before 5.10.258
  • from 5.11 before 5.15.209
  • from 5.16 before 6.1.175
  • from 6.2 before 6.6.141
  • from 6.7 before 6.12.91
  • from 6.13 before 6.18.33
  • from 6.19 before 7.0.10
  • version 7.1-rc1

The record links eight stable-branch patch commits on git.kernel.org. Verify your kernel branch against these commits and your distribution's advisories, because the record does not map every branch to a specific fixed build.

Exploitation status

The record shows no CISA KEV listing and no EPSS data. No confirmed exploitation appears in the sources consulted for this analysis.

Remediation and mitigation

  • Update affected kernels to a stable release that includes the upstream commits listed in the references for your branch.
  • Prioritise systems where the nf_conntrack_sip helper is loaded or used, since this code path applies only when SIP connection tracking is active. This is an inference from the component's purpose.
  • Review the Siemens advisory linked in the record if you use affected Siemens products.

Detection guidance

  • Monitor kernel logs and system stability for unexpected crashes or oops messages in networking components, at a high level.
  • Track kernel package versions across your fleet against the ranges above to find hosts that need updating.

Limitations of the available information

  • The record does not confirm a public proof of concept or observed attacks.
  • The content of the Siemens advisory was not reviewed beyond its listing in the record.
  • The record does not state a precise impact outcome beyond the CWE and CVSS data.
  • The record title is missing and was written for this portal.

Frequently asked questions

What component is affected by CVE-2026-52986?

The record places the issue in the netfilter SIP connection tracking helper (nf_conntrack_sip) of the Linux kernel.

Is this vulnerability listed as actively exploited?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.